apps/iam

Identity & access resources. Source under apps/iam/.

Scope

apps/iam exposes identity and access primitives as resources under iam.grafana.app:

• User, ServiceAccount, Team, Org — identities.
• Role, RoleBinding, Permission, ResourcePermission — RBAC primitives.
• SsoSetting — per-provider SSO configuration.

These mirror the legacy services (pkg/services/user/, pkg/services/team/, pkg/services/accesscontrol/, …) and are the long-term home for IAM data.

Why a separate app?

• Operators want to declare RBAC bindings in YAML.
• External controllers (e.g. SCIM provisioners) want a watch API.
• Internal tooling can use kubectl-like access.

Layout

apps/iam/
├── kinds/                       # CUE schemas
├── pkg/apis/iam/v0alpha1/       # Resources & handlers
├── pkg/storage/                 # Bridge to legacy stores
└── plugin/

pkg/apis/iam/v0alpha1/zz_openapi_gen.go is one of the larger generated files (>3,000 lines), reflecting the breadth of resources in this app.

See also

• Backend / Authentication & access control